Printable View
I need some help because someone is logging into my site and deleting all my files.
They are getting from FTP I believe and this is what I can get from my FTP session contol:
proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52
Also I have tried to change my password but it isn't working.
Help me please. :confused:
you live in North Carolina, and your server is in turkey on a dial up connection? this does need some explaining cause i don't understand what your asking
That is the person who is logging into my site. I am from NC and my host is too. I think that the person is logging in through FTP some how.
If they are loggin in to your site and deleting your stuff, report it to the site that hosts you. Give them full specs and complete information concerning you, your system, and the IP you are using to connect and update your site (You need to be able to demonstrate ownership of the files in question). Then provide them full information you have on the person believed to be doing you wrong. Once you have the greetings taken care of, offer them complete information on what you believe is happening, including the how, whens and whys.
At this point, you may want to do some reasearch and see if they are patched. Perhaps recommending they get patched would be a good way to go.
If this is your account, then talking to the hosting admins will be the only way to get it taken care of.
Hope this helps.
Regards.
Thanks for the tips I will do it right now.
Um, the problem here is with his hosting company, not his PC. Could you explain what you mean? What do you mean logging in through ftp, are you running an ftp server? I don't fully understand.Quote:
OK, I'm gonna make a couple of suggestions here. First, are you running a firewall? If not, go to www.zonelabs.com and download the free version of Zone Alarm. Second, go to www.moosoft.com and download the trial version of 'The Cleaner' and use it to scan for trojans. Doing these two things could provide a quick solution. Good Luck!
EDIT: Could you explain the following line in particular?Quote:
They are getting from FTP I believe
you really arn't being very clear!
it looks like you might have a web site that you maintain through ftp and someone guessed your password.
If its being hosted by a reputable company your usually pretty safe but not always. The company i work for had a web site hosted by a 'reputable firm' and gave full access to anonymous users. nearly **** myself when i discovered that.
odds are though your not using a good password scheme.
Guess I need to crank back the read speed and increase the comprehension level before I open my big keyboard. I was evidently bewildered on that one. :)
unplug the cord from the wall
Well, you shouldn't have any "real" accounts in your FTP server, IMO. Both WU-FTPd and ProFTPd have means to use a password file separate from the real password file on the machine. Ideally, you should use a special password file with different usernames and passwords, then sandbox those users in to special directories (yes, I realize that you can still break out of a chroot'd environment).Quote:
Originally posted here by suzkaw
I need some help because someone is logging into my site and deleting all my files.
They are getting from FTP I believe and this is what I can get from my FTP session contol:
proftpd: suzkaw nwusr-31395.dial-in.ttnet.net.tr: IDLE 18:52
Also I have tried to change my password but it isn't working.
Help me please. :confused:
But, again, that doesn't solve this direct problem, but hopefully helps you prevent a similiar one in the future.
Hopefully you have a good log on their activities... you can boot them and then report the activity to their service provider. Also, you should very carefully search the system for any additional things they might have left behind (with any luck, your logs might be able to help here), including things like a replaced or modified cshrc, login, profile or logout file.
Sorry guys I am a total newbie to the security issue. Let me try and explain it better.
On my website I upload all my files through WSFTP and that is why I thought the person had to be doing it from some program like this. However last night I changed the password again but they still got in.
Hope this clears it up.
Sounds like your local machine is compromised and they're seeing everything you try to do. Go download the latest AV engine/defs and see if you have a trojan of some sort.
Go to webattack.com and get your self a trojan scanner as well. Tauscan works pretty good.
lol@angrybob
Ok guys I changed the password from my school computer and didn't use the password at home but the person was still able to log in and delete files.
I also downloaded the Trojan program and it didn't find any.
What else can I do?
Again, I restate that you should be talking with the hosting admins. They have the ability to monitor and restrict access (at least they are supposed to have that access). As you have no real access to the machines, (ie webbased ftp log and file management with no access to user management) the only thing you can try to do is ensure that your password is a STRONG password. If that is a no go, it will have to go through the hosting admins, or you can move your stuff to a new host.
Regards.
Regards
A few things here,
1. You are assuming that you are the one that is hacked, it may well be the server that is being hacked and not the machine you are ftping from so contact the admin and notify him/her with the info you have found so far.
2. Change your password to the ftp account (after hearing from the admin) from a (now this is important) **different** machine than you have been using (in case that one is compromised).
3. Make sure that your password is a good password and not easily guessed
4. If possible talk to the admin about installing scp or sftp instead of regular ftp. The ftp program sends passwords in plain text so a simple sniffer will give away your password every time.
5. And finally Contact the site admin. (oh I already said that) well do it again.
i have a question
how do they exsaclty hack your computer even they are far from you, do they do this tru your ip address? or what? :confused:
Why do you want to know? From the way you told that is like saying:"Tell how to hack a computer, if i have the IP of a guy then can i hack him?" Remember that this is a site to prevent this happen, so keep off.
im not saying i would use this to hack other computer im just curious how is that possible besides im a newbie remember that had alot of question.
You asked = "How is that possable?" Your kidding me, right? The internet is one big network so you can basicly dailout to anything that is online.
Ok lets say if I were gonna make a remote admin tool....
Client dials to a PC through IP and goes to a open port.
The server listens to a port and waits for bits of data which are commands that tell it what it should do
Ok once the client has connected it sends packets of data which say CMD-BEEP
Then the server receives the data and opens a part of the program which makes a beeping sound.
Go look at TCP/IP and telnet.
Or better yet..... get a programing language and make some network tools of your own.
I hope this has answered questions but at the same time hasn't given anyone any funny ideas......
P.S. this is a old thread.... you should have just posted your own instead.